Loading...
Build a Content-Security-Policy directive by directive or from a preset, import an existing policy to edit, and get header, nginx, and meta-tag snippets.
Space-separated sources. Common values: 'self' 'none' https: data: 'unsafe-inline', or a host like https://cdn.example.com. Leave blank to omit.
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests
Solid No obvious weaknesses in this policy.
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests" always;
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self'; frame-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests">
Serving it as a real header is stronger than the meta tag. Grade a live site with the Security Headers analyzer.